discordrat | aed0081d6aa8fa3b29d155c6bb45e9278b4562102f8d4497a51db56871a74134

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
02-06-2024 02:09

Target

8da8b05938831e8e547b60526236ece7.exe
Size

78KB
MD5

8da8b05938831e8e547b60526236ece7
SHA1

c27806eed416f8676548d89aa0207d028f800234
SHA256

aed0081d6aa8fa3b29d155c6bb45e9278b4562102f8d4497a51db56871a74134
SHA512

552e09c36ec48d3117209546e70b1322b929d3f5c59f49af4e66f51c5123230bec766a7315de022027afc0d41920fa7f86f42d82e4f000ac73bab08136221ec6
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+MPIC:5Zv5PDwbjNrmAE+gIC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTI0NjE3NzQ1MDg3OTA5MDY5OA.GQYQs_.CWWy01exlwJSA5-Ryb8HsR5UWeE5uOF58bPcZs
server_id
1243377281129254984

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 2056	2256	8da8b05938831e8e547b60526236ece7.exe	28
PID 2256 wrote to memory of 2056	2256	8da8b05938831e8e547b60526236ece7.exe	28
PID 2256 wrote to memory of 2056	2256	8da8b05938831e8e547b60526236ece7.exe	28

C:\Users\Admin\AppData\Local\Temp\8da8b05938831e8e547b60526236ece7.exe
"C:\Users\Admin\AppData\Local\Temp\8da8b05938831e8e547b60526236ece7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2256 -s 596
  2⤵
  PID:2056

memory/2256-0-0x000007FEF55F3000-0x000007FEF55F4000-memory.dmp

Filesize
4KB

Download
memory/2256-1-0x000000013FD40000-0x000000013FD58000-memory.dmp

Filesize
96KB

Download
memory/2256-2-0x000007FEF55F0000-0x000007FEF5FDC000-memory.dmp

Filesize
9.9MB

Download
memory/2256-3-0x000007FEF55F3000-0x000007FEF55F4000-memory.dmp

Filesize
4KB

Download
memory/2256-4-0x000007FEF55F0000-0x000007FEF5FDC000-memory.dmp

Filesize
9.9MB

Download